diff options
| author | Balaji Selvanathan <[email protected]> | 2026-05-07 20:50:35 +0530 |
|---|---|---|
| committer | Marek Vasut <[email protected]> | 2026-05-09 02:26:58 +0200 |
| commit | cc8195b13b12cde3192978df64fd8bfac0f591f4 (patch) | |
| tree | 5191fc509137861b81d07e4e1c775fa01b3be05c | |
| parent | 5040410102239a6afd85665c7cfd35bd3f82352c (diff) | |
usb: dwc3: Fix crash on fastboot exit due to incorrect memory free
The dwc3_free_one_event_buffer() function incorrectly called free()
on event buffer structures allocated with devm_kzalloc(). This
caused heap corruption and a synchronous abort when exiting
fastboot mode via "fastboot continue".
Device-managed memory is automatically freed when the device is
removed, so manual deallocation causes the heap allocator to access
corrupted metadata.
Fixes: 884b10e86a05 ("usb: dwc3: core: fix memory leaks in event buffer cleanup")
Signed-off-by: Balaji Selvanathan <[email protected]>
Reviewed-by: Marek Vasut <[email protected]>
| -rw-r--r-- | drivers/usb/dwc3/core.c | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/drivers/usb/dwc3/core.c b/drivers/usb/dwc3/core.c index 0dee14c8b59..be198041f08 100644 --- a/drivers/usb/dwc3/core.c +++ b/drivers/usb/dwc3/core.c @@ -208,7 +208,6 @@ static void dwc3_free_one_event_buffer(struct dwc3 *dwc, struct dwc3_event_buffer *evt) { dma_free_coherent(evt->buf); - free(evt); } /** |